The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A council, NHS body or other public authority data breach does not automatically mean you are owed compensation. Under UK GDPR Article 82, a claim requires an infringement, damage (financial loss or non-material harm such as distress), and a controller or processor responsible for the breach. Only a court can order compensation. You can, however, use a subject access request (SAR) to find out what happened, request erasure where Article 17 allows it, and complain to the Information Commissioner’s Office (ICO) about compliance.
Which route answers which problem?
Four remedies are often confused after a public-sector breach. They have different purposes, decision-makers, deadlines and evidence requirements.
As an Amazon Associate I earn from qualifying purchases.
| Route | Purpose | Who decides it? | Key timing | What you must show |
|---|---|---|---|---|
| Subject access request (SAR) | Obtain your personal data and information about its use | The public authority, subject to exemptions | Normally one month from receipt | Your identity and a clear request; the authority must make a reasonable and proportionate search |
| Article 17 erasure request | Ask the authority to delete personal data when a listed ground applies | The public authority | Without undue delay where the right applies | A relevant Article 17 ground, subject to legal and public-task exceptions |
| ICO complaint | Ask the regulator to examine suspected non-compliance | The ICO | Follow the ICO’s complaint process and any requested timescales | Information showing how the authority may have breached data-protection law |
| Compensation claim | Recover damages for loss or distress caused by an infringement | A court, or a settlement reached with the authority | Litigation limitation rules apply; obtain separate legal advice | Infringement, responsible controller or processor, causation and material or non-material damage |
You can use more than one route. For example, a SAR may reveal the records needed for an erasure request or a damages claim, while an ICO complaint addresses regulatory compliance rather than awarding you money.
Can you claim compensation from a council or NHS body?
Possibly, but the breach alone is not enough. Article 82 of the UK GDPR says: "Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered." You therefore need to connect the legal infringement to damage that you personally suffered and identify the responsible controller or processor.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
What counts as damage?
Material damage includes a quantifiable financial loss, such as costs incurred because information was misused. Non-material damage covers harm that is not a direct financial loss. Section 168 of the Data Protection Act 2018 confirms that non-material damage includes distress. Anxiety, embarrassment or loss of control over personal information may be relevant, but a claimant still needs evidence that the harm was real and resulted from the infringement.
The authoritative sources do not set a statutory tariff, average award or standard payment for a public-sector breach. Awards are fact-specific and court-enforced. A leaked email address with no demonstrated impact and a disclosure of sensitive health information causing documented distress may be assessed very differently. Do not treat a headline settlement figure from another case as an entitlement.
Who can be liable?
The claim must be directed at the controller or processor responsible under the UK GDPR. A public body may be the controller, while a service provider handling data for it may be a processor. Establishing responsibility matters: a general notice that an incident occurred does not, by itself, prove which organisation’s processing infringed your rights.
What the ICO can and cannot do
The ICO can investigate, require information and take regulatory action. It cannot order compensation for you. The ICO’s guidance states: "If a person suffers damage or distress because you have breached their data protection rights … they are entitled to claim compensation from you. Only the courts can enforce their right to compensation." An ICO finding can be useful evidence, but it is not a damages judgment and a regulator’s decision does not automatically establish the amount you should receive.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Preparing a claim or evaluating an offer
Keep the breach notification, the date you received it, emails, letters, screenshots and any records showing what data was involved. Record financial losses with invoices or bank records. Keep a contemporaneous account of distress, symptoms, disruption and any professional help, noting dates rather than relying on memory months later. Ask the authority to preserve relevant logs, correspondence and access records.
If the authority proposes a settlement, compare it with the evidence for four questions: was there an infringement, is this authority or processor responsible, did that infringement cause your loss or distress, and can the harm be evidenced? A solicitor is not mandatory, but litigation limitation rules and settlement wording can have significant consequences, so obtain advice before accepting a final settlement or issuing proceedings.
How to make a subject access request after the breach
A SAR is the practical route to discover what personal data the authority holds and how it was handled. The ICO describes the right of access as giving people the right to obtain a copy of their personal information, together with supplementary information. You may make the request verbally or in writing. You do not have to use the words "subject access request" or cite Article 15, although labelling it clearly can prevent confusion.
Information to ask for
Ask the authority to:
- Confirm whether it processes your personal data.
- Provide a copy of the personal data covered by the request.
- Explain the purposes of processing and the categories of personal data involved.
- Identify recipients or categories of recipients, including overseas recipients if relevant.
- State the planned retention period, or the criteria used to set it.
- Explain your rights to rectification, erasure or restriction, and your right to complain to the ICO.
- Where the data was not collected from you, provide available information about its source.
- Explain any automated decision-making or profiling covered by the access right.
Step-by-step request
- Choose the recipient. Send the request to the authority’s data-protection or information-governance contact, or to the address given in the breach notice. A verbal request to a staff member is legally capable of being a SAR, but written evidence is easier to keep.
- Describe the scope. Give your name, identifiers used by the authority, relevant dates and the breach or service involved. Specify whether you want incident reports, access logs, emails, call recordings, case notes or other categories; a focused request can be processed more efficiently.
- State the statutory request. Say that you are asking for access to your personal data under the UK GDPR and for the supplementary information listed above. Do not include another person’s personal data unless you are authorised to act for them.
- Provide proportionate identity evidence if requested. The authority may need to verify you, but an identity demand should be reasonable and proportionate. Use a secure channel and do not send unnecessary documents.
- Keep proof of receipt. Save the message, delivery confirmation and the date the authority received it. The normal response period is one month from receipt.
- Check the response. Confirm that the authority searched the systems and time periods you identified and supplied the supplementary information, not merely a generic breach summary. If material is missing, ask which systems were searched and why information was withheld.
Mixed requests and the 20-working-day clarification point
A message may combine a SAR with questions about compensation, service failure or an erasure request. ICO guidance updated in 2026 says that, when a public authority is treating a mixed request as a UK GDPR SAR, it should clarify that position within 20 working days. This clarification point does not replace the normal one-month SAR response period; it helps establish which parts of your message are being handled under access rules.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Redactions and exemptions
The authority must make a reasonable and proportionate search, but it may redact or withhold information. Third-party personal data is a common reason, and statutory exemptions can apply. Ask the authority to identify the legal basis for each substantial redaction and explain how you can challenge the decision. A refusal should not be assumed to mean that no data exists.
Some public bodies process information under Part 3 of the Data Protection Act 2018 for law-enforcement purposes. Different rights, restrictions and exemptions can then apply. If the breach concerns policing, criminal investigations or another law-enforcement function, identify that context in your request and obtain specialist advice if the authority relies on Part 3.
Can you make the authority delete your data?
Article 17 provides a right to erasure without undue delay when one of its listed grounds applies. Examples include personal data that is no longer necessary for the purpose for which it was collected, or data processed unlawfully. An erasure request should identify the data and explain the ground you rely on; it is not an automatic deletion button after every breach.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →When erasure may be refused
Erasure is limited where processing is required by domestic law or is necessary for a task carried out in the public interest or in the exercise of official authority. A council may therefore have to retain records to meet statutory duties, administer services, defend legal claims or preserve an accountable public record. Other Article 17 exceptions can also apply. The authority should tell you which exception it relies on and what data, if any, can still be deleted or restricted.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
If the authority made the data public
Where the authority made your personal data public and must erase it, Article 17 requires it to take reasonable steps to inform other controllers processing the data that you requested erasure of links, copies or replications. That duty concerns the authority’s efforts; it does not guarantee that every copy on every system disappears immediately.
Submitting an erasure request
- Identify the specific records, publication, account or data fields you want removed.
- State the Article 17 ground, such as no continuing necessity or unlawful processing.
- Explain any public-facing disclosure and ask what steps will be taken with other controllers.
- Ask for a written decision, the reasons for any refusal and confirmation of deletion or the applicable exception.
- Keep the request and response. If the authority refuses without a convincing explanation, raise the issue through its internal process and the ICO.
What must the authority do after a serious breach?
These duties govern the authority’s incident response; they do not set a compensation amount for individuals.
Informing affected people
Under section 68 of the Data Protection Act 2018, where a breach is likely to result in a high risk to people’s rights and freedoms, the controller must inform affected people without undue delay unless an exception applies. A useful notification should explain what happened, the likely consequences, the data involved and steps you can take. An incomplete notice is a reason to ask targeted questions or make a SAR, not proof by itself that compensation is payable.
Recommended Free Tools
Notifying the regulator
Section 108 requires a serious breach to be notified to the regulator without undue delay. If notification is not made within 72 hours, the reasons for the delay must accompany it. The 72-hour reference point concerns the controller’s regulatory notification, not a deadline for you to claim damages and not a promise that every incident will be reported publicly.
How to use the ICO complaint route
Complain to the authority first where its process allows you to resolve the issue quickly, then provide the ICO with the breach notice, your correspondence, SAR request and response, and a clear chronology. Explain the specific processing or response you believe was unlawful. The ICO may investigate or take enforcement action, but it cannot decide your compensation or act as your litigation representative.
Separate the outcomes you want: ask the ICO to examine compliance, ask the authority for access or erasure, and pursue damages through negotiation or a court claim. Combining all requests in one undifferentiated complaint can make it harder to identify the decision you need.
Evidence checklist and a sensible sequence
- Original breach notification and all later updates.
- Dates, recipients and copies of emails, letters, calls and portal messages.
- Screenshots or photographs showing exposed information, where lawful to retain them.
- Your SAR, proof of receipt, identity correspondence and complete response.
- The erasure request, the Article 17 ground relied on and the authority’s decision.
- Financial-loss evidence such as invoices, replacement costs or transaction records.
- A dated diary of distress, practical effects, medical appointments or counselling, without exaggeration.
- Requests that the authority preserve relevant logs, audit trails and incident records.
A practical order is to preserve evidence first, send a focused SAR, consider erasure separately, complain about unresolved compliance failures, and then obtain advice on compensation if the evidence shows infringement and damage. Do not delay a potential claim while waiting for an ICO outcome without checking the applicable litigation limitation rules.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDo you need a solicitor?
No rule requires a solicitor for a SAR, an Article 17 request or an ICO complaint. You can make each request yourself using plain language. Legal advice becomes more valuable when the data is sensitive, the harm is substantial, responsibility is disputed, the authority relies on Part 3 or an exemption, or you are asked to sign a settlement and release.
A solicitor can assess causation and evidence, identify the correct defendant, advise on limitation and negotiate wording. That assistance has a cost, so ask what work is included and whether any costs or funding arrangement applies. A claims company’s promise of an automatic payout should be treated cautiously: Article 82 still requires proof of infringement, responsibility and damage, and only a court can enforce compensation.
Quick Recap
Key distinctions to keep in mind
- A breach notification is evidence of an incident, not an admission that every affected person suffered compensable damage.
- A SAR gives information; it does not itself require the authority to admit liability or pay money.
- Erasure is conditional and can conflict with statutory retention, public-interest tasks and official authority.
- The ICO regulates compliance; a court determines an enforceable compensation award.
- There is no published tariff in the cited authoritative material, so value depends on the facts and proof of harm.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
